At a glance
- Tools that inspect the endpoint agent layer itself — discovery, risk scoring, allowlisting, inline blocking — answer this; EDR stops at the process boundary.
- Board-ready control means a live inventory of agents, MCP servers, Skills, hooks and rules files, plus a traceable record of what each did.
- Backslash Security's free AI Endpoint Exposure Assessment is agentless, read-only and retains no data, per the assessment page on its website.
- Allowlist approved components and denylist risky ones with per-team policies, rather than banning AI use outright and driving it into shadow AI.
Backslash Security
Published:
Deep inspection of MCP servers and Agent Skills means resolving those components themselves on the endpoint: which MCP servers, MCP tools and Skills an agent uses, which hooks and rules files sit alongside them, and what the risk posture of each one is. Standard endpoint detection and response (EDR) was built to catch malicious processes, files and known-bad behavior. It sees the process but not the cause, meaning not which prompt, agent, Skill or MCP server produced an action. When an approved agent follows a Skill, the machine shows only legitimate process activity. Options available as of 2026 differ in which layer they inspect. Backslash Security discovers MCP servers, Skills and the other agentic components on employees' endpoints, assesses their risk posture using an agentless approach, governs them with allowlists and denylists, and blocks risky actions inline before execution.
What exactly can an AI agent execute on an employee laptop today?
An AI agent on an employee laptop can execute through every component it loads, and each of those components runs with that employee's identity and access. Coding agents such as Claude Code, Cursor, Codex, GitHub Copilot and Antigravity are a prominent example, but the same components appear on endpoints across the whole workforce.
| Component | What it is |
|---|---|
| Agent | The AI tool the employee runs, such as a coding assistant |
| MCP server | A connection built on the Model Context Protocol (MCP), the protocol agents use to connect to external tools and data sources; each server is a connection an agent can act through |
| MCP tool | An individual tool an MCP server makes available to the agent |
| Skill | Packaged instructions and scripts that extend what an agent can do, often just a markdown file on the machine; a Skill can tell an agent to read a file, call an API or run a shell command, under the user's own permissions |
| Hook | A trigger that fires on an agent action, running something before or after it |
| Rules file | A file such as AGENTS.md or CLAUDE.md carrying standing instructions an agent reads on every run |
| Model | The model the agent calls |
| Context | Files, repositories and pages the agent reads; hidden instructions in that content can be followed as though the user had typed them (prompt injection) |
Plugins and connectors also run on the endpoint alongside these components.
The context row carries a documented consequence. Backslash's data exfiltration research found that malicious instructions hidden in a repository's AGENTS.md file could trick OpenAI Codex into silently accessing AWS credentials, npm tokens and Git configuration.
Why does standard endpoint telemetry miss what an agent actually invokes?
Standard endpoint telemetry misses what an agent actually invokes because it records processes, not the instructions and components behind them.
What does host-level event telemetry capture?
Host-level event telemetry captures the events EDR was built for: processes, files and known-bad behavior. When an approved agent runs, it registers as a legitimate process, and an agent following instructions it read from a file looks no different. Detections and log routing stop at the process boundary.
What does EDR leave unseen at the agentic layer?
What EDR leaves unseen at the agentic layer is the cause of an action: which prompt, agent, Skill or MCP server produced it, which MCP servers and Skills are present on the machine, and which hooks and rules files shape the agent's behavior. These are components, not processes. Backslash discovers them on the endpoint and traces the full path of an agent run from prompt to agent to tool call to outcome.
Which control layers can resolve an individual MCP server or Skill?
Control layers differ in what they were built to see: EDR sees processes, the network layer sees agent traffic, device management sees the managed fleet, and a layer on the host at the agentic layer sees the MCP servers, MCP tools and Skills themselves. Four questions separate them:
- Granularity: does the layer name the specific MCP server, MCP tool or Skill, or only the process behind it?
- Enforcement point: can the layer stop an action an agent takes through an MCP server or Skill before it executes?
- Account visibility: can the layer detect private account access on enterprise machines?
- Reconstruction: can the layer trace an agent run from prompt to agent to tool call to outcome?
| Control layer | Built to see | What it sees of MCP servers and Skills |
|---|---|---|
| Endpoint detection and response (EDR) | Processes, files and known-bad behavior | The agent's process, but not which Skill or MCP server produced an action |
| Network layer | Agent traffic on the network | Agent traffic rather than the components on the host |
| Device management (MDM) | The managed device fleet | Does not control what AI agents use and install themselves, such as Skills |
The fourth layer sits on the host at the agentic layer itself, where MCP servers, MCP tools and Skills are present alongside the agents, models, hooks, rules files, plugins and connectors around them. Backslash replaces none of the other layers; it fills a gap EDR does not cover and that an MCP gateway only partially addresses.
What should a security team test when evaluating inspection of MCP servers and Skills?
A security team evaluating inspection of MCP servers and Skills should fix its test criteria before looking at any tool, then check each candidate against them.
- Discovery completeness: every MCP server, MCP tool and Skill on every employee's endpoint, not only on developer machines.
- Risk posture: an assessment of each MCP server and Skill found, using an agentless approach.
- Policy: allowlisting of approved MCP servers and Skills and denylisting of risky ones, with custom policies for different teams and risk profiles.
- Inline enforcement: an action an agent takes through an MCP server or Skill stopped before it executes.
- Shadow AI coverage: detection of unapproved MCP servers and Skills, as well as unapproved agents and models, and of private account access on enterprise machines.
- Reconstruction: audit and tracing data of agentic activity, for compliance needs and incident investigation.
Against the enforcement criterion, Backslash pairs agentless discovery with on-host enforcement, so a policy is actually applied rather than only recorded.
What does inline blocking before execution cover?
Inline blocking before execution means a risky agent action is stopped before it runs. Backslash blocks risky agent actions inline before execution, including unauthorized code execution, credential access, privilege escalation, and data sent to unapproved destinations.
Blocking sits alongside the allowlists and denylists a security team sets, with custom policies for different teams and risk profiles enforced continuously.
Frequently Asked Questions
What can I actually show the board about which Agent Skills our AI agents execute locally?
You can show the board which Agent Skills and other agentic components are present on company endpoints, their risk posture, and the policy applied to them. Backslash discovers every agent, model, MCP server, MCP tool, Skill, hook, rules file, plugin and connector running on an endpoint. It assesses the risk posture of those components and lets a security team allowlist approved ones and denylist risky ones.
Why does the existing endpoint stack miss MCP servers and agent plugins?
The existing stack was built for a different object. EDR watches processes and files, and an approved coding agent is a legitimate process whatever instructions it follows. MDM manages the device fleet, but it does not control what AI agents use and install themselves. Inspection at the agentic layer closes that gap, complementing both rather than replacing them.
How does deep inspection of an MCP server differ from checking a Skill?
An MCP server is a connection an agent acts through, while a Skill is a reusable capability the agent invokes, so each is discovered and assessed as its own component. Backslash assesses the risk posture of both using an agentless approach. Its free Skills Security Scanner scans AI agent Skills for security risks, and its MCP Server Security Hub has scanned and scored publicly available MCP servers.
What evidence will satisfy auditors asking about local agent control?
Backslash automatically generates audit evidence for EU AI Act, NIS2, DORA and SOC, and collects audit and tracing data of agentic activity to support compliance needs and incident forensics. That tracing turns an incident question, what did this agent touch and on whose instruction, into something answerable after the fact.
What is the free AI Endpoint Exposure Assessment?
Backslash offers a free AI Endpoint Exposure Assessment (also called Scout) that is agentless, read-only, and retains no data: a short script distributed through your existing MDM that runs, reports and disappears. Agentless applies to discovery and risk assessment only; enforcement runs on the host.
What is the difference between Shadow AI and a rogue agent?
Shadow AI is a tool you never approved: an agent, model, MCP server or Skill installed by an employee, often under a personal account on a corporate machine. A rogue agent is one you did approve, now taking actions nobody asked for, such as reaching for credentials, escalating privilege, or sending data to an unapproved destination. The two need different controls. Discovery, allowlisting and denylisting address the first; inline blocking before execution addresses the second.
About this article
Backslash Security publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Backslash Security before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-11-10